mirror of
https://github.com/harryssecret/homelab-nix.git
synced 2025-08-09 07:00:21 +02:00
Compare commits
10 commits
7a495909b9
...
4bdec356fa
Author | SHA1 | Date | |
---|---|---|---|
|
4bdec356fa | ||
|
5540b81f4e | ||
|
5588d0225d | ||
|
2957232541 | ||
|
84d27c4279 | ||
|
14955bc2b7 | ||
|
216cd53d70 | ||
|
7e57ead3c5 | ||
|
670ef0cccb | ||
|
4b88a9038c |
8 changed files with 151 additions and 97 deletions
|
@ -2,11 +2,12 @@
|
||||||
{
|
{
|
||||||
# List packages installed in system profile. To search by name, run:
|
# List packages installed in system profile. To search by name, run:
|
||||||
# $ nix-env -qaP | grep wget
|
# $ nix-env -qaP | grep wget
|
||||||
environment.systemPackages =
|
environment.systemPackages = with pkgs;
|
||||||
[
|
[
|
||||||
pkgs.neovim
|
neovim
|
||||||
pkgs.kitty
|
kitty
|
||||||
pkgs.kittysay
|
kittysay
|
||||||
|
terraform
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.direnv.enable = true;
|
programs.direnv.enable = true;
|
||||||
|
|
|
@ -2,13 +2,17 @@
|
||||||
config,
|
config,
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
|
secrets,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
|
let
|
||||||
|
ip = "192.168.1.177";
|
||||||
|
gateway = "192.168.1.1";
|
||||||
|
username = "homelab";
|
||||||
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
./server-configuration.nix
|
|
||||||
./features/default.nix
|
./features/default.nix
|
||||||
../../features/shared/ssh.nix
|
../../features/shared/ssh.nix
|
||||||
];
|
];
|
||||||
|
@ -69,13 +73,57 @@
|
||||||
|
|
||||||
environment.variables.EDITOR = "nvim";
|
environment.variables.EDITOR = "nvim";
|
||||||
|
|
||||||
# Open ports in the firewall.
|
# setting up networking!!
|
||||||
networking.firewall.allowedTCPPorts = [
|
networking = {
|
||||||
22
|
interfaces = {
|
||||||
80
|
ens18.ipv4.addresses = [
|
||||||
443
|
{
|
||||||
8080
|
address = ip;
|
||||||
];
|
prefixLength = 24;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
defaultGateway = gateway;
|
||||||
|
nameservers = [
|
||||||
|
"1.1.1.1"
|
||||||
|
"1.0.0.1"
|
||||||
|
"2606:4700:4700::1111"
|
||||||
|
"2606:4700:4700::1001"
|
||||||
|
];
|
||||||
|
|
||||||
|
nftables.enable = true;
|
||||||
|
# firewall rules
|
||||||
|
firewall = {
|
||||||
|
enable = true;
|
||||||
|
allowedTCPPorts = [
|
||||||
|
22 # ssh
|
||||||
|
80 # http
|
||||||
|
443 # ssh
|
||||||
|
8080
|
||||||
|
];
|
||||||
|
allowedUDPPorts = [ ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
users.groups.multimedia = {
|
||||||
|
members = [
|
||||||
|
"slskd"
|
||||||
|
"radarr"
|
||||||
|
"readarr"
|
||||||
|
"sonarr"
|
||||||
|
"transmission"
|
||||||
|
"jellyfin"
|
||||||
|
"bazarr"
|
||||||
|
"calibre-web"
|
||||||
|
username
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
|
sops.age.generateKey = true;
|
||||||
|
sops.defaultSopsFile = "${secrets}/secrets/secrets.yaml";
|
||||||
|
|
||||||
# reducing disk usage
|
# reducing disk usage
|
||||||
boot.loader.systemd-boot.configurationLimit = 10;
|
boot.loader.systemd-boot.configurationLimit = 10;
|
||||||
|
@ -94,6 +142,7 @@
|
||||||
"dotnet-sdk-wrapped-6.0.428"
|
"dotnet-sdk-wrapped-6.0.428"
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
||||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
# This option defines the first version of NixOS you have installed on this particular machine,
|
||||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||||||
#
|
#
|
||||||
|
|
|
@ -5,7 +5,7 @@
|
||||||
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
|
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
|
||||||
};
|
};
|
||||||
|
|
||||||
hardware.opengl = {
|
hardware.graphics = {
|
||||||
# hardware.opengl in 24.05
|
# hardware.opengl in 24.05
|
||||||
enable = true;
|
enable = true;
|
||||||
extraPackages = with pkgs; [
|
extraPackages = with pkgs; [
|
||||||
|
|
|
@ -18,42 +18,43 @@ in
|
||||||
enable = true;
|
enable = true;
|
||||||
securityType = "user";
|
securityType = "user";
|
||||||
openFirewall = true;
|
openFirewall = true;
|
||||||
settings = ''
|
settings = {
|
||||||
workgroup = WORKGROUP
|
global = {
|
||||||
server string = hyperserver
|
security = "user";
|
||||||
netbios name = hyperserver
|
"hosts allow" = "192.168.1. 127.0.0.1 localhost";
|
||||||
security = user
|
"hosts deny" = "0.0.0.0/0";
|
||||||
'';
|
"guest account" = "nobody";
|
||||||
shares = {
|
"map to guest" = "bad user";
|
||||||
music = {
|
};
|
||||||
|
"music" = {
|
||||||
path = "/srv/media/Music";
|
path = "/srv/media/Music";
|
||||||
browseable = "yes";
|
browseable = "yes";
|
||||||
"read only" = "no";
|
"read only" = "no";
|
||||||
"create mask" = "0644";
|
"create mask" = "0644";
|
||||||
"directory mask" = "0655";
|
"directory mask" = "0755";
|
||||||
};
|
};
|
||||||
ebooks = {
|
"ebooks" = {
|
||||||
path = "${cfg.dir}/Ebooks";
|
path = "${cfg.dir}/Ebooks";
|
||||||
browseable = "yes";
|
browseable = "yes";
|
||||||
"read only" = "no";
|
"read only" = "no";
|
||||||
"create mask" = "0644";
|
"create mask" = "0644";
|
||||||
"directory mask" = "0655";
|
"directory mask" = "0755";
|
||||||
};
|
};
|
||||||
movies = {
|
"movies" = {
|
||||||
path = "${cfg.dir}/Films";
|
path = "${cfg.dir}/Films";
|
||||||
browseable = "yes";
|
browseable = "yes";
|
||||||
"create mask" = "0644";
|
"create mask" = "0644";
|
||||||
"directory mask" = "0655";
|
"directory mask" = "0755";
|
||||||
"read only" = "no";
|
"read only" = "no";
|
||||||
};
|
};
|
||||||
shows = {
|
"shows" = {
|
||||||
path = "${cfg.dir}/SeriesTV";
|
path = "${cfg.dir}/SeriesTV";
|
||||||
"read only" = "no";
|
"read only" = "no";
|
||||||
"create mask" = "0644";
|
"create mask" = "0644";
|
||||||
"directory mask" = "0755";
|
"directory mask" = "0755";
|
||||||
browseable = "yes";
|
browseable = "yes";
|
||||||
};
|
};
|
||||||
torrents = {
|
"torrents" = {
|
||||||
path = "${cfg.dir}/Torrents";
|
path = "${cfg.dir}/Torrents";
|
||||||
"read only" = "yes";
|
"read only" = "yes";
|
||||||
"create mask" = "644";
|
"create mask" = "644";
|
||||||
|
@ -61,6 +62,19 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
services.samba-wsdd = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
|
services.avahi = {
|
||||||
|
enable = true;
|
||||||
|
publish.enable = true;
|
||||||
|
publish.userServices = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -71,7 +71,7 @@
|
||||||
;
|
;
|
||||||
|
|
||||||
memories = pkgs.fetchNextcloudApp {
|
memories = pkgs.fetchNextcloudApp {
|
||||||
sha256 = "sha256-DJPskJ4rTECTaO1XJFeOD1EfA3TQR4YXqG+NIti0UPE=";
|
sha256 = "sha256-tzxeffvwMwthvBRG+/cLCXZkVS32rlf5v7XOKTbGoOo=";
|
||||||
url = "https://github.com/pulsejet/memories/releases/download/v7.3.1/memories.tar.gz";
|
url = "https://github.com/pulsejet/memories/releases/download/v7.3.1/memories.tar.gz";
|
||||||
license = "agpl3Only";
|
license = "agpl3Only";
|
||||||
};
|
};
|
||||||
|
@ -84,8 +84,8 @@
|
||||||
};
|
};
|
||||||
*/
|
*/
|
||||||
facerecognition = pkgs.fetchNextcloudApp {
|
facerecognition = pkgs.fetchNextcloudApp {
|
||||||
sha256 = "1dfpmnyyrjyn7wbjfj3w072rzfl7zwm8ppphgsg8ampw2dy7y6yk";
|
sha256 = "sha256-FtYItN0Iy2QpSNf0GPs7fIPYgBdEuKHJGwZ7GQNySZE=";
|
||||||
url = "https://github.com/matiasdelellis/facerecognition/releases/download/v0.9.51/facerecognition.tar.gz";
|
url = "https://github.com/matiasdelellis/facerecognition/releases/download/v0.9.60/facerecognition.tar.gz";
|
||||||
license = "agpl3Only";
|
license = "agpl3Only";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -1,65 +0,0 @@
|
||||||
# TODO: move file to configuration.nix
|
|
||||||
{
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
secrets,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
let
|
|
||||||
ip = "192.168.1.177";
|
|
||||||
gateway = "192.168.1.1";
|
|
||||||
username = "homelab";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
# setting up networking!!
|
|
||||||
networking = {
|
|
||||||
interfaces = {
|
|
||||||
ens18.ipv4.addresses = [
|
|
||||||
{
|
|
||||||
address = ip;
|
|
||||||
prefixLength = 24;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
defaultGateway = gateway;
|
|
||||||
nameservers = [
|
|
||||||
"1.1.1.1"
|
|
||||||
"1.0.0.1"
|
|
||||||
"2606:4700:4700::1111"
|
|
||||||
"2606:4700:4700::1001"
|
|
||||||
];
|
|
||||||
|
|
||||||
nftables.enable = true;
|
|
||||||
# firewall rules
|
|
||||||
firewall = {
|
|
||||||
enable = true;
|
|
||||||
allowedTCPPorts = [
|
|
||||||
22 # ssh
|
|
||||||
80 # http
|
|
||||||
443 # ssh
|
|
||||||
];
|
|
||||||
allowedUDPPorts = [ ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
users.groups.multimedia = {
|
|
||||||
members = [
|
|
||||||
"slskd"
|
|
||||||
"radarr"
|
|
||||||
"readarr"
|
|
||||||
"sonarr"
|
|
||||||
"transmission"
|
|
||||||
"jellyfin"
|
|
||||||
"bazarr"
|
|
||||||
"calibre-web"
|
|
||||||
username
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
sops.defaultSopsFile = "${secrets}/secrets/secrets.yaml";
|
|
||||||
}
|
|
20
hosts/strawberry/configuration.nix
Normal file
20
hosts/strawberry/configuration.nix
Normal file
|
@ -0,0 +1,20 @@
|
||||||
|
{pkgs, username, ...}: {
|
||||||
|
services.samba = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.nas = {
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.${username} = {
|
||||||
|
isNormalUser = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tempfiles.rules = [
|
||||||
|
"d /srv/files 0755 nas nas"
|
||||||
|
];
|
||||||
|
|
||||||
|
system.stateVersion = "24.11";
|
||||||
|
}
|
35
terraform/main.tf
Normal file
35
terraform/main.tf
Normal file
|
@ -0,0 +1,35 @@
|
||||||
|
provider "proxmox" {
|
||||||
|
pm_api_url = "https://your-proxmox-server:8006/api2/json"
|
||||||
|
pm_tls_insecure = true
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "proxmox_vm_qemu" "nixos-services-vm" {
|
||||||
|
name = "nixos-services-vm"
|
||||||
|
target_node = "pve"
|
||||||
|
clone = "template-name"
|
||||||
|
os_type = "cloud-init"
|
||||||
|
cores = 2
|
||||||
|
memory = 2048
|
||||||
|
disk {
|
||||||
|
size = "10G"
|
||||||
|
}
|
||||||
|
network {
|
||||||
|
model = "virtio"
|
||||||
|
bridge = "vmbr0"
|
||||||
|
}
|
||||||
|
sshkeys = file("~/.ssh/id_rsa.pub")
|
||||||
|
ipconfig0 = "ip=dhcp"
|
||||||
|
cloud_init {
|
||||||
|
user_data = <<EOF
|
||||||
|
#cloud-config
|
||||||
|
users:
|
||||||
|
- name: nixos
|
||||||
|
ssh-authorized-keys:
|
||||||
|
- ${file("~/.ssh/id_rsa.pub")}
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
output "nixos_vm_ip" {
|
||||||
|
value = proxmox_vm_qemu.nixos_vm.network.0.ip
|
||||||
|
}
|
Loading…
Add table
Add a link
Reference in a new issue